126073 2013-12-20 10:47:58 -0800 Crashes in AccessibilityRenderObject::computeAccessibilityIsIgnored() 2013-12-21 12:24:40 -0800 1 1 1 Unclassified WebKit Accessibility 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 126118 1 koivisto webkit-unassigned aboxhall apinheiro ap cfleizach commit-queue dmazzoni eflews.bot gyuyoung.kim jcraig jdiggs kling koivisto mario rego+ews samuel_white webkit-bug-importer xan.lopez oldest_to_newest 961908 0 koivisto 2013-12-20 10:47:58 -0800 http://build.webkit.org/results/Apple%20Mavericks%20Debug%20WK1%20(Tests)/r160914%20(1262)/editing/spelling/spellcheck-async-mutation-crash-log.txt http://build.webkit.org/results/Apple%20MountainLion%20Release%20WK1%20(Tests)/r160914%20(15848)/dom/xhtml/level2/html/HTMLInputElement01-crash-log.txt 961909 1 webkit-bug-importer 2013-12-20 10:48:09 -0800 <rdar://problem/15709541> 961914 2 219770 koivisto 2013-12-20 10:53:49 -0800 Created attachment 219770 patch 961915 3 219770 rniwa 2013-12-20 10:56:14 -0800 Comment on attachment 219770 patch rs=me 961916 4 219770 eflews.bot 2013-12-20 10:58:30 -0800 Comment on attachment 219770 patch Attachment 219770 did not pass efl-ews (efl): Output: http://webkit-queues.appspot.com/results/44378325 961917 5 219770 ap 2013-12-20 10:59:13 -0800 Comment on attachment 219770 patch View in context: https://bugs.webkit.org/attachment.cgi?id=219770&action=review > Source/WebCore/accessibility/AccessibilityRenderObject.cpp:1192 > + // FIXME: Somehow the renderer is becoming null. I'd say: // FIXME (bug number): Some regression tests flakily crash without this check. It is not clear whether the renderer may legitimately be null here. 961919 6 219770 eflews.bot 2013-12-20 11:02:36 -0800 Comment on attachment 219770 patch Attachment 219770 did not pass efl-wk2-ews (efl-wk2): Output: http://webkit-queues.appspot.com/results/49338291 961920 7 koivisto 2013-12-20 11:02:46 -0800 https://trac.webkit.org/r160916 961955 8 cfleizach 2013-12-20 11:37:46 -0800 This is a bit risky to put in without having someone familiar with accessibility review it. I'm not sure what kind of negative effects it will have at all. Was another bug opened to have someone look at this again? Rather than ramming the other patch down WebKit and putting in temporary hacks, it might be better to work through the problems in tandem before committing 962004 9 koivisto 2013-12-20 12:56:58 -0800 (In reply to comment #8) > This is a bit risky to put in without having someone familiar with accessibility review it. I'm not sure what kind of negative effects it will have at all. > > Was another bug opened to have someone look at this again? > > Rather than ramming the other patch down WebKit and putting in temporary hacks, it might be better to work through the problems in tandem before committing We are trying to understand the crash. The changes are temporary. 962010 10 koivisto 2013-12-20 12:58:47 -0800 This is fallout from http://trac.webkit.org/changeset/160908 962045 11 koivisto 2013-12-20 14:11:34 -0800 Looks like there are some dead objects here http://build.webkit.org/results/Apple%20Mavericks%20Debug%20WK1%20(Tests)/r160922%20(1266)/fast/body-propagation/background-image/003-xhtml-crash-log.txt 962048 12 koivisto 2013-12-20 14:12:55 -0800 reopening 962238 13 koivisto 2013-12-21 04:50:14 -0800 This looks like the root cause: http://build.webkit.org/results/Apple%20Mavericks%20Debug%20WK1%20(Tests)/r160955%20(1283)/fast/events/nested-event-remove-node-crash-crash-log.txt 12 com.apple.WebCore 0x00000001079381c8 WebCore::Style::resolveTree(WebCore::Document&, WebCore::Style::Change) + 520 (StyleResolveTree.cpp:880) 13 com.apple.WebCore 0x0000000107c4ace6 WebCore::Document::recalcStyle(WebCore::Style::Change) + 438 (Document.cpp:1760) 14 com.apple.WebCore 0x0000000107c474df WebCore::Document::updateStyleIfNeeded() + 431 (Document.cpp:1809) 15 com.apple.WebCore 0x00000001080d16df WebCore::HTMLElement::supportsFocus() const + 111 (HTMLElement.cpp:667) 16 com.apple.WebCore 0x00000001077169c6 WebCore::AccessibilityNodeObject::canSetFocusAttribute() const + 214 (AccessibilityNodeObject.cpp:1985) 17 com.apple.WebCore 0x0000000107723839 WebCore::AccessibilityRenderObject::inheritsPresentationalRole() const + 41 (AccessibilityRenderObject.cpp:2625) 18 com.apple.WebCore 0x0000000107722d95 WebCore::AccessibilityRenderObject::computeAccessibilityIsIgnored() const + 325 (AccessibilityRenderObject.cpp:1183) 19 com.apple.WebCore 0x000000010771e84f WebCore::AccessibilityObject::accessibilityIsIgnored() const + 191 (AccessibilityObject.cpp:2133) 20 com.apple.WebCore 0x00000001077080cd WebCore::AccessibilityObject::notifyIfIgnoredValueChanged() + 29 (AccessibilityObject.cpp:2033) 21 com.apple.WebCore 0x0000000107708dc8 WebCore::AXObjectCache::recomputeIsIgnored(WebCore::RenderObject*) + 56 (AXObjectCache.cpp:864) 22 com.apple.WebCore 0x0000000108be0359 WebCore::RenderBlock::deleteLines() + 73 (RenderBlock.cpp:932) 23 com.apple.WebCore 0x0000000109462ea2 WebCore::RenderBlockFlow::deleteLines() + 450 (RenderBlockFlow.cpp:1827) 24 com.apple.WebCore 0x0000000108be10cd WebCore::RenderBlock::removeChild(WebCore::RenderObject&) + 1709 (RenderBlock.cpp:1191) 25 com.apple.WebCore 0x0000000108d91e06 WebCore::RenderObject::removeFromParent() + 70 (RenderObject.cpp:187) 26 com.apple.WebCore 0x0000000108d9c2f3 WebCore::RenderObject::willBeDestroyed() + 163 (RenderObject.cpp:1865) 27 com.apple.WebCore 0x0000000108e77647 WebCore::RenderText::willBeDestroyed() + 167 (RenderText.cpp:284) 28 com.apple.WebCore 0x0000000108d9c8bd WebCore::RenderObject::destroy() + 29 (RenderObject.cpp:1985) 29 com.apple.WebCore 0x0000000108d9c892 WebCore::RenderObject::destroyAndCleanupAnonymousWrappers() + 274 (RenderObject.cpp:1975) 30 com.apple.WebCore 0x0000000107937012 WebCore::Style::detachTextRenderer(WebCore::Text&) + 50 (StyleResolveTree.cpp:414) 31 com.apple.WebCore 0x0000000107938661 WebCore::Style::detachChildren(WebCore::ContainerNode&, WebCore::Style::DetachType) + 81 We are entering style resolve from the middle of render tree destruction. 962253 14 cfleizach 2013-12-21 07:31:18 -0800 (In reply to comment #13) > This looks like the root cause: > > http://build.webkit.org/results/Apple%20Mavericks%20Debug%20WK1%20(Tests)/r160955%20(1283)/fast/events/nested-event-remove-node-crash-crash-log.txt > > 12 com.apple.WebCore 0x00000001079381c8 WebCore::Style::resolveTree(WebCore::Document&, WebCore::Style::Change) + 520 (StyleResolveTree.cpp:880) > 13 com.apple.WebCore 0x0000000107c4ace6 WebCore::Document::recalcStyle(WebCore::Style::Change) + 438 (Document.cpp:1760) > 14 com.apple.WebCore 0x0000000107c474df WebCore::Document::updateStyleIfNeeded() + 431 (Document.cpp:1809) > 15 com.apple.WebCore 0x00000001080d16df WebCore::HTMLElement::supportsFocus() const + 111 (HTMLElement.cpp:667) > 16 com.apple.WebCore 0x00000001077169c6 WebCore::AccessibilityNodeObject::canSetFocusAttribute() const + 214 (AccessibilityNodeObject.cpp:1985) > 17 com.apple.WebCore 0x0000000107723839 WebCore::AccessibilityRenderObject::inheritsPresentationalRole() const + 41 (AccessibilityRenderObject.cpp:2625) > 18 com.apple.WebCore 0x0000000107722d95 WebCore::AccessibilityRenderObject::computeAccessibilityIsIgnored() const + 325 (AccessibilityRenderObject.cpp:1183) > 19 com.apple.WebCore 0x000000010771e84f WebCore::AccessibilityObject::accessibilityIsIgnored() const + 191 (AccessibilityObject.cpp:2133) > 20 com.apple.WebCore 0x00000001077080cd WebCore::AccessibilityObject::notifyIfIgnoredValueChanged() + 29 (AccessibilityObject.cpp:2033) > 21 com.apple.WebCore 0x0000000107708dc8 WebCore::AXObjectCache::recomputeIsIgnored(WebCore::RenderObject*) + 56 (AXObjectCache.cpp:864) > 22 com.apple.WebCore 0x0000000108be0359 WebCore::RenderBlock::deleteLines() + 73 (RenderBlock.cpp:932) > 23 com.apple.WebCore 0x0000000109462ea2 WebCore::RenderBlockFlow::deleteLines() + 450 (RenderBlockFlow.cpp:1827) > 24 com.apple.WebCore 0x0000000108be10cd WebCore::RenderBlock::removeChild(WebCore::RenderObject&) + 1709 (RenderBlock.cpp:1191) > 25 com.apple.WebCore 0x0000000108d91e06 WebCore::RenderObject::removeFromParent() + 70 (RenderObject.cpp:187) > 26 com.apple.WebCore 0x0000000108d9c2f3 WebCore::RenderObject::willBeDestroyed() + 163 (RenderObject.cpp:1865) > 27 com.apple.WebCore 0x0000000108e77647 WebCore::RenderText::willBeDestroyed() + 167 (RenderText.cpp:284) > 28 com.apple.WebCore 0x0000000108d9c8bd WebCore::RenderObject::destroy() + 29 (RenderObject.cpp:1985) > 29 com.apple.WebCore 0x0000000108d9c892 WebCore::RenderObject::destroyAndCleanupAnonymousWrappers() + 274 (RenderObject.cpp:1975) > 30 com.apple.WebCore 0x0000000107937012 WebCore::Style::detachTextRenderer(WebCore::Text&) + 50 (StyleResolveTree.cpp:414) > 31 com.apple.WebCore 0x0000000107938661 WebCore::Style::detachChildren(WebCore::ContainerNode&, WebCore::Style::DetachType) + 81 > > We are entering style resolve from the middle of render tree destruction. Two thoughts: Does WebCore::HTMLElement::supportsFocus() really need to update the style calculations? It's possible this work WebCore::AXObjectCache::recomputeIsIgnored can be pended on a timer to run during the next runloop iteration 962262 15 koivisto 2013-12-21 11:58:42 -0800 Looks like https://trac.webkit.org/r160966 fixed this. 962263 16 koivisto 2013-12-21 12:24:40 -0800 Rolled out the hack fix in https://trac.webkit.org/r160968 219770 2013-12-20 10:53:49 -0800 2013-12-20 11:02:35 -0800 patch accessibility-crash.patch text/plain 3586 koivisto SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDE2MDkxNSkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE5IEBACisyMDEzLTEyLTIwICBBbnR0aSBL b2l2aXN0byAgPGFudHRpQGFwcGxlLmNvbT4KKworICAgICAgICBDcmFzaGVzIGluIEFjY2Vzc2li aWxpdHlSZW5kZXJPYmplY3Q6OmNvbXB1dGVBY2Nlc3NpYmlsaXR5SXNJZ25vcmVkKCkKKyAgICAg ICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEyNjA3MworCisgICAg ICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFByZXZlbnQgdGhlIGNy YXNoIGFuZCB0cnkgdG8gY2F0Y2ggaW4gZGVidWcgd2h5IGl0IGlzIGhhcHBlbmluZy4KKworICAg ICAgICAqIGFjY2Vzc2liaWxpdHkvQWNjZXNzaWJpbGl0eVJlbmRlck9iamVjdC5jcHA6CisgICAg ICAgIChXZWJDb3JlOjpBY2Nlc3NpYmlsaXR5UmVuZGVyT2JqZWN0OjpBY2Nlc3NpYmlsaXR5UmVu ZGVyT2JqZWN0KToKKyAgICAgICAgKFdlYkNvcmU6OkFjY2Vzc2liaWxpdHlSZW5kZXJPYmplY3Q6 On5BY2Nlc3NpYmlsaXR5UmVuZGVyT2JqZWN0KToKKyAgICAgICAgKFdlYkNvcmU6OkFjY2Vzc2li aWxpdHlSZW5kZXJPYmplY3Q6OmRldGFjaCk6CisgICAgICAgIChXZWJDb3JlOjpBY2Nlc3NpYmls aXR5UmVuZGVyT2JqZWN0Ojpjb21wdXRlQWNjZXNzaWJpbGl0eUlzSWdub3JlZCk6CisgICAgICAg ICogYWNjZXNzaWJpbGl0eS9BY2Nlc3NpYmlsaXR5UmVuZGVyT2JqZWN0Lmg6CisKIDIwMTMtMTIt MjAgIEFudHRpIEtvaXZpc3RvICA8YW50dGlAYXBwbGUuY29tPgogCiAgICAgICAgIEZpeCBhc3Nl cnRpbmcgYWNjZXNpYmlsaXR5IHRlc3RzLgpJbmRleDogU291cmNlL1dlYkNvcmUvYWNjZXNzaWJp bGl0eS9BY2Nlc3NpYmlsaXR5UmVuZGVyT2JqZWN0LmNwcAo9PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2Uv V2ViQ29yZS9hY2Nlc3NpYmlsaXR5L0FjY2Vzc2liaWxpdHlSZW5kZXJPYmplY3QuY3BwCShyZXZp c2lvbiAxNjA5MDQpCisrKyBTb3VyY2UvV2ViQ29yZS9hY2Nlc3NpYmlsaXR5L0FjY2Vzc2liaWxp dHlSZW5kZXJPYmplY3QuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0xMDAsNiArMTAwLDcgQEAKICNp bmNsdWRlICJWaXNpYmxlVW5pdHMuaCIKICNpbmNsdWRlICJodG1sZWRpdGluZy5oIgogI2luY2x1 ZGUgPHd0Zi9TdGRMaWJFeHRyYXMuaD4KKyNpbmNsdWRlIDx3dGYvVGVtcG9yYXJ5Q2hhbmdlLmg+ CiAjaW5jbHVkZSA8d3RmL3RleHQvU3RyaW5nQnVpbGRlci5oPgogI2luY2x1ZGUgPHd0Zi91bmlj b2RlL0NoYXJhY3Rlck5hbWVzLmg+CiAKQEAgLTExMCw2ICsxMTEsNyBAQCB1c2luZyBuYW1lc3Bh Y2UgSFRNTE5hbWVzOwogQWNjZXNzaWJpbGl0eVJlbmRlck9iamVjdDo6QWNjZXNzaWJpbGl0eVJl bmRlck9iamVjdChSZW5kZXJPYmplY3QqIHJlbmRlcmVyKQogICAgIDogQWNjZXNzaWJpbGl0eU5v ZGVPYmplY3QocmVuZGVyZXItPm5vZGUoKSkKICAgICAsIG1fcmVuZGVyZXIocmVuZGVyZXIpCisg ICAgLCBtX2luQ29tcHV0ZUFjY2Vzc2liaWxpdHlJc0lnbm9yZWQoZmFsc2UpCiB7CiAjaWZuZGVm IE5ERUJVRwogICAgIG1fcmVuZGVyZXItPnNldEhhc0FYT2JqZWN0KHRydWUpOwpAQCAtMTE5LDYg KzEyMSw3IEBAIEFjY2Vzc2liaWxpdHlSZW5kZXJPYmplY3Q6OkFjY2Vzc2liaWxpdHkKIEFjY2Vz c2liaWxpdHlSZW5kZXJPYmplY3Q6On5BY2Nlc3NpYmlsaXR5UmVuZGVyT2JqZWN0KCkKIHsKICAg ICBBU1NFUlQoaXNEZXRhY2hlZCgpKTsKKyAgICBBU1NFUlQoIW1faW5Db21wdXRlQWNjZXNzaWJp bGl0eUlzSWdub3JlZCk7CiB9CiAKIHZvaWQgQWNjZXNzaWJpbGl0eVJlbmRlck9iamVjdDo6aW5p dCgpCkBAIC0xNDEsNiArMTQ0LDcgQEAgdm9pZCBBY2Nlc3NpYmlsaXR5UmVuZGVyT2JqZWN0Ojpk ZXRhY2goQQogICAgIGlmIChtX3JlbmRlcmVyKQogICAgICAgICBtX3JlbmRlcmVyLT5zZXRIYXNB WE9iamVjdChmYWxzZSk7CiAjZW5kaWYKKyAgICBBU1NFUlQoIW1faW5Db21wdXRlQWNjZXNzaWJp bGl0eUlzSWdub3JlZCk7CiAgICAgbV9yZW5kZXJlciA9IDA7CiB9CiAKQEAgLTExNTUsNiArMTE1 OSw3IEBAIGJvb2wgQWNjZXNzaWJpbGl0eVJlbmRlck9iamVjdDo6Y29tcHV0ZUEKIHsKICNpZm5k ZWYgTkRFQlVHCiAgICAgQVNTRVJUKG1faW5pdGlhbGl6ZWQpOworICAgIFRlbXBvcmFyeUNoYW5n ZTxib29sPihtX2luQ29tcHV0ZUFjY2Vzc2liaWxpdHlJc0lnbm9yZWQsIHRydWUpOwogI2VuZGlm CiAKICAgICAvLyBDaGVjayBmaXJzdCBpZiBhbnkgb2YgdGhlIGNvbW1vbiByZWFzb25zIGNhdXNl IHRoaXMgZWxlbWVudCB0byBiZSBpZ25vcmVkLgpAQCAtMTE4Myw3ICsxMTg4LDExIEBAIGJvb2wg QWNjZXNzaWJpbGl0eVJlbmRlck9iamVjdDo6Y29tcHV0ZUEKICAgICAvLyBBbGxvdyB0aGUgcGxh dGZvcm0gdG8gZGVjaWRlIGlmIHRoZSBhdHRhY2htZW50IGlzIGlnbm9yZWQgb3Igbm90LgogICAg IGlmIChpc0F0dGFjaG1lbnQoKSkKICAgICAgICAgcmV0dXJuIGFjY2Vzc2liaWxpdHlJZ25vcmVB dHRhY2htZW50KCk7Ci0gICAgCisKKyAgICAvLyBGSVhNRTogU29tZWhvdyB0aGUgcmVuZGVyZXIg aXMgYmVjb21pbmcgbnVsbC4KKyAgICBpZiAoIW1fcmVuZGVyZXIpCisgICAgICAgIHJldHVybiBm YWxzZTsKKwogICAgIC8vIGlnbm9yZSBwb3B1cCBtZW51IGl0ZW1zIGJlY2F1c2UgQXBwS2l0IGRv ZXMKICAgICBpZiAoYW5jZXN0b3JzT2ZUeXBlPFJlbmRlck1lbnVMaXN0PigqbV9yZW5kZXJlciku Zmlyc3QoKSkKICAgICAgICAgcmV0dXJuIHRydWU7CkluZGV4OiBTb3VyY2UvV2ViQ29yZS9hY2Nl c3NpYmlsaXR5L0FjY2Vzc2liaWxpdHlSZW5kZXJPYmplY3QuaAo9PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3Vy Y2UvV2ViQ29yZS9hY2Nlc3NpYmlsaXR5L0FjY2Vzc2liaWxpdHlSZW5kZXJPYmplY3QuaAkocmV2 aXNpb24gMTYwOTA0KQorKysgU291cmNlL1dlYkNvcmUvYWNjZXNzaWJpbGl0eS9BY2Nlc3NpYmls aXR5UmVuZGVyT2JqZWN0LmgJKHdvcmtpbmcgY29weSkKQEAgLTIxMSw2ICsyMTEsMTAgQEAgcHVi bGljOgogCiBwcm90ZWN0ZWQ6CiAgICAgUmVuZGVyT2JqZWN0KiBtX3JlbmRlcmVyOworCisjaWZu ZGVmIE5ERUJVRworICAgIG11dGFibGUgYm9vbCBtX2luQ29tcHV0ZUFjY2Vzc2liaWxpdHlJc0ln bm9yZWQ7CisjZW5kaWYKICAgICAKICAgICB2b2lkIHNldFJlbmRlck9iamVjdChSZW5kZXJPYmpl Y3QqIHJlbmRlcmVyKSB7IG1fcmVuZGVyZXIgPSByZW5kZXJlcjsgfQogICAgIGJvb2wgbmVlZHNU b1VwZGF0ZUNoaWxkcmVuKCkgY29uc3QgeyByZXR1cm4gbV9jaGlsZHJlbkRpcnR5OyB9Cg==